HIPAA compliant phone system? Business phone services that sign a BAA
Business phone services for practices that sign a BAA — on which plans, how you put the agreement in place, and what to set up for voicemail, recordings, texts and AI features.
Phone systems at a glance
A business phone system can handle patient calls under HIPAA when the provider signs a BAA for the services you use — voicemail, call recordings, transcripts and texts all hold PHI — and you set up where voicemails go, who can hear recordings and what goes out by text. We compare 7 products in Phone systems. 4 sign a Business Associate Agreement (Dialpad, Nextiva, RingCentral RingEX, Weave). 3 sign one only for certain plans or products (8x8 X Series, Google Voice, Quo). Every value links to the vendor's own documentation and shows when it was checked.
| Sign a BAA | Dialpad, Nextiva, RingCentral RingEX, Weave |
|---|---|
| Only some plans or products | 8x8 X Series, Google Voice, Quo |
| Products compared | 7 |
3 more facts
| Compared on | BAA without a sales process, BAA on entry-level team plans |
|---|---|
| Commissions | None — no vendor pays us |
| Facts checked since | 2026-10-17 |
Comparison
Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.
| Product | Signs a BAA | BAA without a sales process | BAA on entry-level team plans |
|---|---|---|---|
| 8x8 X Series | Conditional | No | Not verified |
| Dialpad | Yes | Yes | Yes |
| Google Voice | Conditional | Yes | Not verified |
| Nextiva | Yes | Not verified | Not verified |
| Quo | Conditional | No | No |
| RingCentral RingEX | Yes | Not verified | Not verified |
| Weave | Yes | Yes | Not verified |
Found an outdated or wrong fact? Report it
What to check before you choose
- A BAA for the services you use
- Voicemail, call recordings, transcripts, fax and texts are stored by the provider, so it is a business associate for them. Check which services and add-ons the BAA lists — calls, texting, fax, AI summaries — on the plan you use (164.502(e)).
- Voicemail and recordings
- Voicemail sent to email as an audio file or transcript puts PHI in your mailbox. Some providers switch this off for HIPAA accounts. Use the provider's supported protected way to access voicemail; if voicemail or transcripts are forwarded to email, assess the receiving email service, its BAA coverage and safeguards (164.312(a), (e)). We recommend keeping PHI out of notification emails where practical, and limiting who can play recordings.
- Texts from the phone system
- Business texting to a patient's phone travels as ordinary SMS. Keep messages to what is needed, confirm the number, and record the patient's choice — see texting.
- AI call summaries and transcription
- AI features process call content. Use them with PHI only if the BAA covers them, and check whether the provider uses recordings to train models. Before recording or enabling live transcription, check applicable recording-consent and notice laws, including for calls across state lines, and the vendor's contractual requirements. A BAA does not provide consent to record.
- Who can hear what
- One login per person, shared lines limited to the staff who answer them, and call logs you can review (164.312(a), (b)). Before sharing PHI, establish who is calling and why they may receive it. Verify identity and authority where they are unknown, following the applicable rule (164.514(h)); disclosures to family members and caregivers have their own conditions (164.510(b)).
Common mistakes
- Voicemail forwarded to personal email or phones.
- A free or personal phone app for patient calls because it is already on everyone's phone.
- Turning on AI call summaries without checking that the BAA covers them.
How we compare
- BAA without a sales process
- You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
- BAA on entry-level team plans
- The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.